vjw0rm | 3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f

Analysis

max time kernel
143s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:50

Target

3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f.js
Size

8KB
MD5

c595f56942b02cee85675d6a73203392
SHA1

0d3a0cbb1dbc5a379d126c58731d2d8413b96203
SHA256

3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f
SHA512

645b7803fc8cd60ffe2353dd15fd8ccd3dcf3d074736dd4a89f0d4c0a8589d8f4a22ee157cdbac2c38a43cc007653ab6b531c86b205ec380ec1f52e848057fd9
SSDEEP

96:v5XKP2NXtklLoNj/XxKWr6F7ruUbQOQEQuE+GbFadY7l09tNNSZmM1ZFCZ9X/Z6y:hKPsXtkldOIlbJoad8lG

Score

10^/10

vjw0rm trojan worm

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3f0320201b0870d0d9027157e9b60897aba8fa245bc3276ac3faa083497a444f.js
1⤵
- Drops startup file
PID:3436

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact